Skip to content

fix: Add Sec-WebSocket-Key and Sec-WebSocket-Version headers when proxying WebSocket from HTTP/2 to HTTP/1 #39375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

ZJfans
Copy link

@ZJfans ZJfans commented May 7, 2025

Partially fixes #38645

Commit Message:
Implement addition of Sec-WebSocket-Key and Sec-WebSocket-Version headers when Envoy proxies WebSocket requests from HTTP/2 to HTTP/1.
Ensure proper WebSocket upgrade headers are added in compliance with RFC 6455 during HTTP/2 to HTTP/1 proxying.

Note: Sec-WebSocket-Accept header verification is not yet implemented in this PR.

Additional Description:
This PR implements the automatic addition of Sec-WebSocket-Key and Sec-WebSocket-Version request headers when the WebSocket protocol is requested by HTTP/2 client in Envoy and proxied to HTTP/1 backend to comply with RFC 6455 standard.
When the client uses HTTP/2 to make a WebSocket connection with Envoy, Envoy needs to ensure that the WebSocket handshake request contains Sec-WebSocket-Key and Sec-WebSocket-Version request headers when proxied to the HTTP/1 backend. According to RFC 6455, these headers must be included when the client initiates a WebSocket handshake.
Specific implementation:
Sec-WebSocket-Key processing: Envoy will generate a Sec-WebSocket-Key for each WebSocket request and add it to the request header.
Sec-WebSocket-Version processing: Envoy will set Sec-WebSocket-Version to 13, which is the version required by the current WebSocket protocol standard.

Risk Level:
Medium: This functionality involves handling WebSocket headers, which can impact the correctness of WebSocket handshakes. Proper verification and handling are necessary.

Testing:
Manual testing has been conducted in a local environment to verify that Sec-WebSocket-Key and Sec-WebSocket-Version headers are correctly added during the WebSocket handshake from HTTP/2 to HTTP/1.

Automated tests will be added in a follow-up PR to ensure comprehensive coverage and future maintainability.

Docs Changes: None
Release Notes: None
Platform Specific Features: None
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

Copy link

Hi @ZJfans, welcome and thank you for your contribution.

We will try to review your Pull Request as quickly as possible.

In the meantime, please take a look at the contribution guidelines if you have not done so already.

🐱

Caused by: #39375 was opened by ZJfans.

see: more, trace.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

WebSocket upgrades only work for the first stream when allow_connect is enabled in http2_protocol_options
1 participant